Add named draft preview grants

[guidefari]

Goal

Allow authenticated users to preview selected draft content without making them creators, editors, or admins.

Direction

• Keep assigned creators and admins as the default draft viewers.
• Add persisted grants for both whole shows and individual content items.
• Show grants are inherited by child items.
• Grants are additive only; there are no explicit deny overrides.
• Centralize the authorization policy so more roles can be added later without scattering role checks.
• Provide a simple way for an authorized owner/admin to add and revoke named users.
• Keep drafts absent from public lists, feeds, search, profiles, resolve routes, and anonymous direct lookups.

This follows the direct-upload and draft pilot in #131. Protecting the media URL itself is tracked in #203.

[linear-code]

OPS-128